====================================== | [ 25.261655][ T73] ================================================================== | [ 25.262149][ T73] BUG: KASAN: slab-use-after-free in kobject_put (lib/kobject.c:733) | [ 25.262518][ T73] Read of size 1 at addr ffff8880025ec6c4 by task kworker/u16:1/73 | [ 25.262884][ T73] [ 25.263023][ T73] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 25.263028][ T73] Workqueue: netns cleanup_net [ 25.263040][ T73] Call Trace: [ 25.263043][ T73] [ 25.263047][ T73] dump_stack_lvl (lib/dump_stack.c:123) [ 25.263056][ T73] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 25.263067][ T73] ? kobject_put (lib/kobject.c:733) [ 25.263073][ T73] print_report (mm/kasan/report.c:483) [ 25.263079][ T73] ? kobject_put (lib/kobject.c:733) [ 25.263083][ T73] ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47) [ 25.263089][ T73] ? kobject_put (lib/kobject.c:733) [ 25.263094][ T73] kasan_report (mm/kasan/report.c:597) [ 25.263101][ T73] ? kobject_put (lib/kobject.c:733) [ 25.263108][ T73] kobject_put (lib/kobject.c:733) [ 25.263113][ T73] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 25.263121][ T73] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 25.263127][ T73] ? generic_xdp_install (net/core/dev.c:11630) [ 25.263131][ T73] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 25.263145][ T73] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 25.263155][ T73] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 25.263159][ T73] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 25.263168][ T73] cleanup_net (net/core/net_namespace.c:698) [ 25.263175][ T73] ? net_passive_dec (net/core/net_namespace.c:660) [ 25.263183][ T73] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 25.263192][ T73] process_one_work (kernel/workqueue.c:3268) [ 25.263206][ T73] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 25.263214][ T73] ? assign_work (kernel/workqueue.c:1206) [ 25.263221][ T73] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 25.263232][ T73] ? rescuer_thread (kernel/workqueue.c:3373) [ 25.263239][ T73] kthread (kernel/kthread.c:463) [ 25.263247][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.263251][ T73] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 25.263258][ T73] ? __lock_release (kernel/locking/lockdep.c:5536) [ 25.263264][ T73] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 25.263269][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.263276][ T73] ret_from_fork (arch/x86/kernel/process.c:164) [ 25.263280][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.263285][ T73] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 25.286240][ T73] refcount_t: underflow; use-after-free. | [ 25.286487][ T73] WARNING: CPU: 2 PID: 73 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 25.286900][ T73] Modules linked in: netdevsim psample | [ 25.287603][ T73] Tainted: [B]=BAD_PAGE [ 25.287780][ T73] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 25.288037][ T73] Workqueue: netns cleanup_net [ 25.288256][ T73] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 25.288542][ T73] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba 05 b9 e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff All code ======== 0: cc int3 1: 38 03 cmp %al,(%rbx) 3: 80 fb 01 cmp $0x1,%bl 6: 0f 87 29 33 d7 fe ja 0xfffffffffed73335 c: 83 e3 01 and $0x1,%ebx f: 0f 85 51 ff ff ff jne 0xffffffffffffff66 15: c6 05 17 cc 38 03 01 movb $0x1,0x338cc17(%rip) # 0x338cc33 1c: 90 nop 1d: 48 c7 c7 40 ba 05 b9 mov $0xffffffffb905ba40,%rdi 24: e8 62 d6 16 ff call 0xffffffffff16d68b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: e9 33 ff ff ff jmp 0xffffffffffffff66 33: 48 89 df mov %rbx,%rdi 36: e8 c0 9d a0 ff call 0xffffffffffa09dfb 3b: e9 ba fe ff ff jmp 0xfffffffffffffefa Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: e9 33 ff ff ff jmp 0xffffffffffffff3c 9: 48 89 df mov %rbx,%rdi c: e8 c0 9d a0 ff call 0xffffffffffa09dd1 11: e9 ba fe ff ff jmp 0xfffffffffffffed0 [ 25.289248][ T73] RSP: 0018:ffffc900004e7a08 EFLAGS: 00010282 [ 25.289509][ T73] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 25.289796][ T73] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 25.290096][ T73] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff7400934 [ 25.290402][ T73] R10: 0000000000000003 R11: ffffc900004e7580 R12: 0000000000000001 [ 25.290677][ T73] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 25.290998][ T73] FS: 0000000000000000(0000) GS:ffff8880ab808000(0000) knlGS:0000000000000000 [ 25.291465][ T73] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.291728][ T73] CR2: 00005642b0aec220 CR3: 0000000004eea001 CR4: 0000000000772ef0 [ 25.292094][ T73] PKRU: 55555554 [ 25.292295][ T73] Call Trace: [ 25.292507][ T73] [ 25.292682][ T73] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 25.293001][ T73] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 25.293312][ T73] ? generic_xdp_install (net/core/dev.c:11630) [ 25.293604][ T73] ? net_generic (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48) [ 25.293917][ T73] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 25.294225][ T73] ? rtnl_net_dumpid_one (net/core/net_namespace.c:223) [ 25.294514][ T73] ? cleanup_net (./include/linux/list.h:191 net/core/net_namespace.c:693) [ 25.294815][ T73] cleanup_net (net/core/net_namespace.c:698) [ 25.295262][ T73] ? net_passive_dec (net/core/net_namespace.c:660) [ 25.295553][ T73] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 25.295862][ T73] process_one_work (kernel/workqueue.c:3268) [ 25.296327][ T73] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3165) [ 25.296629][ T73] ? assign_work (kernel/workqueue.c:1206) [ 25.300355][ T73] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 25.300633][ T73] ? rescuer_thread (kernel/workqueue.c:3373) [ 25.300877][ T73] kthread (kernel/kthread.c:463) [ 25.301070][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.301365][ T73] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 25.301579][ T73] ? __lock_release (kernel/locking/lockdep.c:5536) [ 25.301828][ T73] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 25.302059][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.302324][ T73] ret_from_fork (arch/x86/kernel/process.c:164) [ 25.307396][ T73] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 25.307701][ T73] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) | [ 37.961066][ T257] ------------[ cut here ]------------ | [ 37.961398][ T257] kernel BUG at net/core/net-sysfs.c:2246! | [ 37.961731][ T257] Oops: invalid opcode: 0000 [#1] SMP KASAN | [ 37.962559][ T257] Tainted: [B]=BAD_PAGE, [W]=WARN [ 37.962795][ T257] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 37.963104][ T257] RIP: 0010:netdev_release (net/core/net-sysfs.c:2246 net/core/net-sysfs.c:2242) [ 37.963362][ T257] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 20 48 8b bb b0 fa ff ff e8 9c 81 d1 fe 48 89 ef 5b 5d e9 62 8e d1 fe 90 <0f> 0b e8 0a 65 d8 fe eb bc e8 63 65 d8 fe eb d9 90 f3 0f 1e fa 0f All code ======== 0: 00 00 add %al,(%rax) 2: 00 fc add %bh,%ah 4: ff lcall (bad) 5: df 48 89 fisttps -0x77(%rax) 8: fa cli 9: 48 c1 ea 03 shr $0x3,%rdx d: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 11: 75 20 jne 0x33 13: 48 8b bb b0 fa ff ff mov -0x550(%rbx),%rdi 1a: e8 9c 81 d1 fe call 0xfffffffffed181bb 1f: 48 89 ef mov %rbp,%rdi 22: 5b pop %rbx 23: 5d pop %rbp 24: e9 62 8e d1 fe jmp 0xfffffffffed18e8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: e8 0a 65 d8 fe call 0xfffffffffed8653b 31: eb bc jmp 0xffffffffffffffef 33: e8 63 65 d8 fe call 0xfffffffffed8659b 38: eb d9 jmp 0x13 3a: 90 nop 3b: f3 0f 1e fa endbr64 3f: 0f .byte 0xf Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: e8 0a 65 d8 fe call 0xfffffffffed86511 7: eb bc jmp 0xffffffffffffffc5 9: e8 63 65 d8 fe call 0xfffffffffed86571 e: eb d9 jmp 0xffffffffffffffe9 10: 90 nop 11: f3 0f 1e fa endbr64 15: 0f .byte 0xf [ 37.964231][ T257] RSP: 0018:ffffc90000a678a8 EFLAGS: 00010297 [ 37.964618][ T257] RAX: 0000000000000000 RBX: ffff888015682688 RCX: ffffffffb8b7ab51 [ 37.964973][ T257] RDX: 1ffff11002ad04cc RSI: ffffffffb90602c0 RDI: ffff888015682660 [ 37.965320][ T257] RBP: ffff888015682000 R08: 0000000000000001 R09: ffffed1002ad04d8 [ 37.965662][ T257] R10: ffff8880156826c3 R11: ffffffffb62000b0 R12: ffff88800c87ca00 [ 37.966022][ T257] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100 [ 37.966386][ T257] FS: 00007fdc51bef740(0000) GS:ffff8880ab888000(0000) knlGS:0000000000000000 [ 37.966802][ T257] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.967092][ T257] CR2: 00007fdc44458490 CR3: 000000000bfd8006 CR4: 0000000000772ef0 [ 37.967444][ T257] PKRU: 55555554 [ 37.967619][ T257] Call Trace: [ 37.967794][ T257] [ 37.967924][ T257] device_release (drivers/base/core.c:2570) [ 37.968165][ T257] kobject_cleanup (lib/kobject.c:693) [ 37.968401][ T257] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 37.968632][ T257] ? generic_xdp_install (net/core/dev.c:11630) [ 37.968913][ T257] ? kfree (mm/slub.c:6630 mm/slub.c:6837) [ 37.969147][ T257] nsim_destroy (drivers/net/netdevsim/netdev.c:1186) netdevsim [ 37.969363][ T257] __nsim_dev_port_del (drivers/net/netdevsim/dev.c:441 drivers/net/netdevsim/dev.c:1474) netdevsim [ 37.969628][ T257] nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1483 drivers/net/netdevsim/dev.c:1707) netdevsim [ 37.969895][ T257] nsim_drv_remove (drivers/net/netdevsim/dev.c:1724) netdevsim [ 37.970106][ T257] device_release_driver_internal (drivers/base/dd.c:1276 drivers/base/dd.c:1297) [ 37.970355][ T257] ? klist_put (lib/klist.c:220) [ 37.970502][ T257] bus_remove_device (./include/linux/kobject.h:193 drivers/base/base.h:73 drivers/base/bus.c:586) [ 37.970698][ T257] device_del (drivers/base/core.c:3879) [ 37.970899][ T257] ? __device_link_del (drivers/base/core.c:3833) [ 37.971119][ T257] ? kernfs_fop_write_iter (fs/kernfs/file.c:77 fs/kernfs/file.c:344) [ 37.971342][ T257] device_unregister (drivers/base/core.c:3796 drivers/base/core.c:3920) [ 37.971582][ T257] del_device_store (drivers/net/netdevsim/bus.c:248) netdevsim [ 37.971873][ T257] ? sysfs_file_kobj (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/linux/rcupdate.h:1195 fs/sysfs/file.c:24) [ 37.972087][ T257] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 37.972322][ T257] ? nsim_bus_dev_numvfs_show (drivers/net/netdevsim/bus.c:215) netdevsim [ 37.972571][ T257] ? sysfs_file_kobj (fs/sysfs/file.c:26) [ 37.972774][ T257] ? sysfs_file_ops (fs/sysfs/file.c:135) [ 37.973018][ T257] kernfs_fop_write_iter (fs/kernfs/file.c:88 fs/kernfs/file.c:356) [ 37.973227][ T257] vfs_write (fs/read_write.c:594 fs/read_write.c:686) [ 37.973407][ T257] ? kernel_write (fs/read_write.c:667) [ 37.973643][ T257] ? lock_vma_under_rcu (mm/mmap_lock.c:259) [ 37.973873][ T257] ? __handle_mm_fault (mm/memory.c:6454) [ 37.974104][ T257] ksys_write (fs/read_write.c:738) [ 37.974268][ T257] ? __ia32_sys_read (fs/read_write.c:728) [ 37.974491][ T257] ? do_user_addr_fault (./arch/x86/include/asm/atomic.h:93 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/mmap_lock.h:143 ./include/linux/mmap_lock.h:182 arch/x86/mm/fault.c:1338) [ 37.974707][ T257] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 37.974928][ T257] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 37.975193][ T257] RIP: 0033:0x7fdc51dce257 [ 37.975416][ T257] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 All code ======== 0: 0f 00 (bad) 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b7 jmp 0xffffffffffffffc7 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 48 89 54 24 18 mov %rdx,0x18(%rsp) 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 74 24 je 0x64 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 48 89 54 24 18 mov %rdx,0x18(%rsp) 12: 48 rex.W 13: 89 .byte 0x89 14: 74 24 je 0x3a [ 37.976243][ T257] RSP: 002b:00007ffff7baba88 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 37.976566][ T257] RAX: ffffffffffffffda RBX: 00007fdc51bef6e0 RCX: 00007fdc51dce257 [ 37.976913][ T257] RDX: 0000000000000004 RSI: 000055b9aaeb3040 RDI: 0000000000000005 [ 37.977322][ T257] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000002 [ 37.977674][ T257] R10: 0000000000000002 R11: 0000000000000246 R12: 00007fdc439ab940 Finger prints: print_report:kasan_report:kobject_put:netdev_run_todo:ops_undo_list netdev_release:device_release:kobject_cleanup:netdev_run_todo:nsim_destroy refcount_warn_saturate:netdev_run_todo:ops_undo_list:cleanup_net:process_one_work